Merge pull request sap-linuxlab#1224 from ja9fuchs/feat-hsr-multinic

sap_ha_install_hana_hsr: Add dedicated replication network support

Author: ja9fuchs

roles/sap_ha_install_hana_hsr/README.md

@@ -60,11 +60,13 @@ It is recommended to execute this role together with other roles in this collect
             node_ip: "10.10.10.10"
             node_role: primary
             hana_site: DC01
+            node_hsr_ip: "192.168.10.10"  # optional
 
           - node_name: h01hana1
             node_ip: "10.10.10.11"
             node_role: secondary
             hana_site: DC02
+            node_hsr_ip: "192.168.10.11"  # optional
 
         sap_ha_install_hana_hsr_sid: H01
         sap_ha_install_hana_hsr_instance_number: "01"
@@ -131,6 +133,11 @@ This can be inherited from the variable `sap_hana_cluster_nodes`.
     Available options: `primary`, `secondary`.<br>
 - **hana_site**<br>
     A unique logical site name (e.g., DC01, EU-WEST) (String).<br>
+- **node_hsr_ip** (optional)<br>
+    IP address of the dedicated replication network interface (String).<br>
+    When set, configures `[system_replication_hostname_resolution]` in `global.ini`
+    to map each peer's hostname to its replication IP.<br>
+    It must be defined for all nodes or none.<br>
 
 Example:
 
@@ -140,18 +147,20 @@ sap_ha_install_hana_hsr_cluster_nodes:
     node_ip: '192.168.1.11'
     node_role: 'primary'
     hana_site: 'DC01'
+    node_hsr_ip: '10.0.0.11'
 
   - node_name: 'node02'
     node_ip: '192.168.1.12'
     node_role: 'secondary'
     hana_site: 'DC02'
+    node_hsr_ip: '10.0.0.12'
 ```
 
 ### sap_ha_install_hana_hsr_hdbuserstore_system_backup_user
 - _Type:_ `string`
 - _Default:_ `HDB_SYSTEMDB`
 
-The hdbuserstore key used for connecting to the SYSTEMDB for administrative tasks like backups.
+The hdbuserstore key used for connecting to the SYSTEMDB for administrative tasks like backups or updating the global.ini.
 
 ### sap_ha_install_hana_hsr_db_system_password
 - _Type:_ `string`
@@ -239,4 +248,13 @@ The specified ports are opened directly and no service definition is created.<br
 Optional name of firewall zone where service or ports will be configured.<br>
 Default firewall zone, usually `public`, is used if this variable is undefined.
 
-<!-- END Role Variables -->
+### sap_ha_install_hana_hsr_listeninterface
+- _Type:_ `string`
+
+SAP HANA System Replication listen interface.<br>
+Controls which network interface HANA listens on for incoming replication connections.<br>
+Available values: `.internal`, `.global`.<br>
+When not set, listeninterface is not configured and HANA uses its default.<br>
+Setting `.internal` requires `node_hsr_ip` to be defined on all nodes.
+
+<!-- END Role Variables -->

roles/sap_ha_install_hana_hsr/defaults/main.yml

@@ -23,19 +23,26 @@ sap_ha_install_hana_hsr_instance_number: ''
 #   node_role: (string) Role of the node in the HSR setup. Valid options: 'primary', 'secondary'.
 #   hana_site: (string) A unique logical site name (e.g., DC01, EU-WEST).
 #
+# Optional key for dedicated replication network:
+#   node_hsr_ip: (string) IP address of the dedicated replication interface.
+#     When set, configures [system_replication_hostname_resolution] in global.ini
+#     to map each peer's hostname to its replication IP.
+#
 # Example:
 # sap_ha_install_hana_hsr_cluster_nodes:
 #   - node_name: "hana01"
 #     node_ip: "10.0.0.1"
 #     node_role: primary
 #     hana_site: DC01
+#     node_hsr_ip: "192.168.10.1"
 #   - node_name: "hana02"
 #     node_ip: "10.0.0.2"
 #     node_role: secondary
 #     hana_site: DC02
+#     node_hsr_ip: "192.168.10.2"
 sap_ha_install_hana_hsr_cluster_nodes: []
 
-# The hdbuserstore key used for connecting to the SYSTEMDB for administrative tasks like backups (String).
+# The hdbuserstore key used for connecting to the SYSTEMDB for administrative tasks like backups or updating the global.ini (String).
 sap_ha_install_hana_hsr_hdbuserstore_system_backup_user: HDB_SYSTEMDB
 
 # Password for the HANA 'SYSTEM' user (String).
@@ -104,3 +111,9 @@ sap_ha_install_hana_hsr_configure_firewall: false
 # Optional name of firewall zone where service or ports will be configured.
 # Default firewall zone, usually `public`, is used if this variable is undefined.
 # sap_ha_install_hana_hsr_firewall_zone: ''
+
+# Optional: SAP HANA System Replication listen interface (String).
+# Controls which network interface HANA listens on for incoming replication connections.
+# Available values: '.internal', '.global'.
+# When not set, listeninterface is not configured and HANA uses its default.
+# sap_ha_install_hana_hsr_listeninterface: ''

roles/sap_ha_install_hana_hsr/tasks/main.yml

@@ -91,6 +91,16 @@
           tags: hsr_logmode
       tags: hsr_logmode
 
+    - name: SAP HSR - Configure dedicated HSR network
+      ansible.builtin.include_tasks:
+        file: pre_tasks/configure_hsr_network.yml
+        apply:
+          tags: hsr_network
+      when:
+        - __sap_ha_install_hana_hsr_fact_replication_network or
+          sap_ha_install_hana_hsr_listeninterface | d('') | length > 0
+      tags: hsr_network
+
     - name: SAP HSR - Prepare and sync PKI Files
       ansible.builtin.include_tasks:
         file: pre_tasks/sync_pki_files.yml

roles/sap_ha_install_hana_hsr/tasks/pre_tasks/configure_hsr_network.yml

@@ -0,0 +1,85 @@
+# SPDX-License-Identifier: Apache-2.0
+---
+# Configure replication network settings at SYSTEM layer only. HOST layer overrides are not managed by this role.
+
+- name: SAP HSR - Check current system_replication_hostname_resolution in global.ini
+  become: true
+  become_user: "{{ __sap_ha_install_hana_hsr_sid | lower }}adm"
+  ansible.builtin.shell:
+    cmd: |
+      /usr/sap/{{ __sap_ha_install_hana_hsr_sid }}/SYS/exe/hdb/hdbsql \
+      -U {{ sap_ha_install_hana_hsr_hdbuserstore_system_backup_user }} \
+      -m <<EOF
+      SELECT KEY, VALUE FROM M_INIFILE_CONTENTS
+        WHERE FILE_NAME = 'global.ini'
+        AND LAYER_NAME = 'SYSTEM'
+        AND SECTION = 'system_replication_hostname_resolution'
+        AND KEY = '{{ node_item.node_hsr_ip }}'
+        AND VALUE = '{{ node_item.node_name }}';
+      EOF
+  loop: "{{ sap_ha_install_hana_hsr_cluster_nodes }}"
+  loop_control:
+    label: "{{ node_item.node_hsr_ip | d('undefined') }} = {{ node_item.node_name }}"
+    loop_var: node_item
+  register: __sap_ha_install_hana_hsr_register_hostname_resolution
+  changed_when: false
+  failed_when: false
+  when: __sap_ha_install_hana_hsr_fact_replication_network
+
+- name: SAP HSR - Configure system_replication_hostname_resolution in global.ini
+  become: true
+  become_user: "{{ __sap_ha_install_hana_hsr_sid | lower }}adm"
+  ansible.builtin.shell:
+    cmd: |
+      /usr/sap/{{ __sap_ha_install_hana_hsr_sid }}/SYS/exe/hdb/hdbsql \
+      -U {{ sap_ha_install_hana_hsr_hdbuserstore_system_backup_user }} \
+      -m <<EOF
+      ALTER SYSTEM ALTER CONFIGURATION('global.ini','SYSTEM')
+        SET ('system_replication_hostname_resolution','{{ node_item.node_item.node_hsr_ip }}')
+        = '{{ node_item.node_item.node_name }}' WITH RECONFIGURE;
+      EOF
+  loop: "{{ __sap_ha_install_hana_hsr_register_hostname_resolution.results }}"
+  loop_control:
+    label: "{{ node_item.node_item.node_hsr_ip | d('undefined') }} = {{ node_item.node_item.node_name }}"
+    loop_var: node_item
+  changed_when: true
+  when:
+    - __sap_ha_install_hana_hsr_fact_replication_network
+    - node_item.node_item.node_name not in node_item.stdout
+
+- name: SAP HSR - Check current listeninterface in global.ini
+  become: true
+  become_user: "{{ __sap_ha_install_hana_hsr_sid | lower }}adm"
+  ansible.builtin.shell:
+    cmd: |
+      /usr/sap/{{ __sap_ha_install_hana_hsr_sid }}/SYS/exe/hdb/hdbsql \
+      -U {{ sap_ha_install_hana_hsr_hdbuserstore_system_backup_user }} \
+      -m <<EOF
+      SELECT VALUE FROM M_INIFILE_CONTENTS
+        WHERE FILE_NAME = 'global.ini'
+        AND LAYER_NAME = 'SYSTEM'
+        AND SECTION = 'system_replication_communication'
+        AND KEY = 'listeninterface'
+        AND VALUE = '{{ sap_ha_install_hana_hsr_listeninterface }}';
+      EOF
+  register: __sap_ha_install_hana_hsr_register_listeninterface
+  changed_when: false
+  failed_when: false
+  when: sap_ha_install_hana_hsr_listeninterface | d('') | length > 0
+
+- name: SAP HSR - Configure listeninterface in global.ini
+  become: true
+  become_user: "{{ __sap_ha_install_hana_hsr_sid | lower }}adm"
+  ansible.builtin.shell:
+    cmd: |
+      /usr/sap/{{ __sap_ha_install_hana_hsr_sid }}/SYS/exe/hdb/hdbsql \
+      -U {{ sap_ha_install_hana_hsr_hdbuserstore_system_backup_user }} \
+      -m <<EOF
+      ALTER SYSTEM ALTER CONFIGURATION('global.ini','SYSTEM')
+        SET ('system_replication_communication','listeninterface')
+        = '{{ sap_ha_install_hana_hsr_listeninterface }}' WITH RECONFIGURE;
+      EOF
+  changed_when: true
+  when:
+    - sap_ha_install_hana_hsr_listeninterface | d('') | length > 0
+    - sap_ha_install_hana_hsr_listeninterface not in __sap_ha_install_hana_hsr_register_listeninterface.stdout

roles/sap_ha_install_hana_hsr/tasks/pre_tasks/prepare_variables.yml

@@ -246,11 +246,12 @@
     success_msg: |
       PASS: Node '{{ node_item.node_name }}' has all required attributes.
     fail_msg: |
-      FAIL: Node '{{ node_item.node_name | default('undefined') }}' is missing required attributes or has empty values.
+      FAIL: Node '{{ node_item.node_name | d('undefined') }}' is missing required attributes or has empty values.
       Each node must have 'node_name', 'node_ip', 'node_role', and 'hana_site' defined with non-empty values."
+    quiet: true
   loop: "{{ __sap_ha_install_hana_hsr_cluster_nodes }}"
   loop_control:
-    label: "{{ node_item.node_name | default('N/A') }}"
+    label: "{{ node_item.node_name | d('N/A') }}"
     loop_var: node_item
 
 - name: SAP HSR - Assert that nodes in 'sap_ha_install_hana_hsr_cluster_nodes' have required 'node_role' values.
@@ -270,16 +271,65 @@
       {% endif %}
 
 
+# Replication network
+- name: SAP HSR - Set fact for replication network availability
+  ansible.builtin.set_fact:
+    __sap_ha_install_hana_hsr_fact_replication_network:
+      "{{ __sap_ha_install_hana_hsr_cluster_nodes | selectattr('node_hsr_ip', 'defined') | list | length > 0 }}"
+
+- name: SAP HSR - Assert that all nodes define 'node_hsr_ip' when any node does
+  ansible.builtin.assert:
+    that:
+      - node_item.node_hsr_ip is defined
+      - node_item.node_hsr_ip is string
+      - node_item.node_hsr_ip | trim | string | length > 0
+    success_msg: |
+      PASS: Node '{{ node_item.node_name }}' has 'node_hsr_ip' defined.
+    fail_msg: |
+      FAIL: Node '{{ node_item.node_name }}' parameter 'node_hsr_ip' is undefined, empty, or invalid.
+      When using a dedicated replication network, all nodes must define 'node_hsr_ip'.
+    quiet: true
+  loop: "{{ __sap_ha_install_hana_hsr_cluster_nodes }}"
+  loop_control:
+    label: "{{ node_item.node_name }}"
+    loop_var: node_item
+  when: __sap_ha_install_hana_hsr_fact_replication_network
+
+
+# Listeninterface
+- name: SAP HSR - Assert that the variable 'sap_ha_install_hana_hsr_listeninterface' is valid
+  ansible.builtin.assert:
+    that:
+      - sap_ha_install_hana_hsr_listeninterface is string
+      - sap_ha_install_hana_hsr_listeninterface in ['.internal', '.global']
+    success_msg: |
+      PASS: The variable 'sap_ha_install_hana_hsr_listeninterface' is '{{ sap_ha_install_hana_hsr_listeninterface }}'.
+    fail_msg: |
+      FAIL: The variable 'sap_ha_install_hana_hsr_listeninterface' must be '.internal' or '.global'.
+  when: sap_ha_install_hana_hsr_listeninterface | d('') | length > 0
+
+- name: SAP HSR - Assert that 'node_hsr_ip' is defined when listeninterface is '.internal'
+  ansible.builtin.assert:
+    that:
+      - __sap_ha_install_hana_hsr_fact_replication_network
+    fail_msg: |
+      FAIL: 'sap_ha_install_hana_hsr_listeninterface' is set to '.internal' but no 'node_hsr_ip' is defined.
+      HANA needs [system_replication_hostname_resolution] entries to bind to the internal interface.
+      Define 'node_hsr_ip' on all nodes in 'sap_ha_install_hana_hsr_cluster_nodes'.
+  when: sap_ha_install_hana_hsr_listeninterface | d('') == '.internal'
+
+
 # Host specific cluster configuration
 - name: SAP HSR - Set host specific connection variable
   ansible.builtin.set_fact:
     __sap_ha_install_hana_hsr_connection:
       node_fqdn: "{{ node_item.node_name }}"
       node_name: "{{ node_item.node_name.split('.')[0] }}"
-      node_domain: "{{ node_item.node_name.split('.')[1:] | join('.') or __sap_ha_install_hana_hsr_domain | default('') }}"
+      node_domain: "{{ node_item.node_name.split('.')[1:] | join('.') or __sap_ha_install_hana_hsr_domain | d('') }}"
       node_ip: "{{ node_item.node_ip }}"
       node_role: "{{ node_item.node_role }}"
       hana_site: "{{ node_item.hana_site }}"
+      node_hsr_ip: "{{ node_item.node_hsr_ip | d('') }}"
   loop: "{{ __sap_ha_install_hana_hsr_cluster_nodes }}"
   loop_control:
     label: "{{ node_item.node_name }}"
@@ -291,8 +341,8 @@
 # Sets host specific flags that are used for running tasks on specific hosts.
 - name: SAP HSR - Set fact with boolean flags for each host
   ansible.builtin.set_fact:
-    __sap_ha_install_hana_hsr_fact_is_primary: "{{ __sap_ha_install_hana_hsr_connection.node_role | default('') == 'primary' }}"
-    __sap_ha_install_hana_hsr_fact_is_secondary: "{{ __sap_ha_install_hana_hsr_connection.node_role | default('') == 'secondary' }}"
+    __sap_ha_install_hana_hsr_fact_is_primary: "{{ __sap_ha_install_hana_hsr_connection.node_role | d('') == 'primary' }}"
+    __sap_ha_install_hana_hsr_fact_is_secondary: "{{ __sap_ha_install_hana_hsr_connection.node_role | d('') == 'secondary' }}"
 
 - name: SAP HSR - Check that host is a defined member of the HSR cluster
   ansible.builtin.assert:
@@ -316,6 +366,16 @@
 
       If this host is not supposed to be part of the HSR cluster, please remove it from hosts in Ansible Play.
 
+- name: SAP HSR - Assert that 'node_hsr_ip' is present on this host
+  ansible.builtin.assert:
+    that:
+      - __sap_ha_install_hana_hsr_connection.node_hsr_ip in ansible_facts['all_ipv4_addresses']
+    fail_msg: |
+      FAIL: The 'node_hsr_ip' ({{ __sap_ha_install_hana_hsr_connection.node_hsr_ip }})
+      is not configured on host '{{ __sap_ha_install_hana_hsr_connection.node_name }}'.
+      The replication IP must be present on a network interface before configuring HSR.
+  when: __sap_ha_install_hana_hsr_fact_replication_network
+
 # Set details of primary for connection from secondary
 - name: SAP HSR - Set connection variables for primary node
   ansible.builtin.set_fact:

roles/sap_ha_install_hana_hsr/tasks/pre_tasks/set_log_mode.yml

@@ -1,30 +1,40 @@
 # SPDX-License-Identifier: Apache-2.0
 ---
+# Set log_mode at SYSTEM layer only. HOST layer overrides are not managed by this role.
 
-- name: SAP HSR - check log_mode
+- name: SAP HSR - Check current log_mode in SYSTEM global.ini
   become: true
   become_user: "{{ __sap_ha_install_hana_hsr_sid | lower }}adm"
   ansible.builtin.shell:
-    cmd: >-
-      set -o pipefail &&
-      grep "log_mode" /usr/sap/{{ __sap_ha_install_hana_hsr_sid }}/SYS/global/hdb/custom/config/global.ini | grep normal
+    cmd: |
+      /usr/sap/{{ __sap_ha_install_hana_hsr_sid }}/SYS/exe/hdb/hdbsql \
+      -U {{ sap_ha_install_hana_hsr_hdbuserstore_system_backup_user }} \
+      -m <<EOF
+      SELECT VALUE FROM M_INIFILE_CONTENTS
+        WHERE FILE_NAME = 'global.ini'
+        AND LAYER_NAME = 'SYSTEM'
+        AND SECTION = 'persistence'
+        AND KEY = 'log_mode'
+        AND VALUE = 'normal';
+      EOF
   register: __sap_ha_install_hana_hsr_register_log_mode
   failed_when: false
   changed_when: false
 
-# CHECK, if ansible_facts['hostname'] needs to be replaced with interface name
-# This task will fail when HSR is already configured, because secondary node nameserver is not running with port 3XX13.
-- name: SAP HSR - Set log_mode to normal
+# This task will fail when HSR is already configured,
+# because secondary node nameserver is not running with port 3XX13.
+- name: SAP HSR - Set log_mode to normal for SYSTEM
   become: true
   become_user: "{{ __sap_ha_install_hana_hsr_sid | lower }}adm"
   ansible.builtin.shell:
     cmd: |
       /usr/sap/{{ __sap_ha_install_hana_hsr_sid }}/SYS/exe/hdb/hdbsql \
       -U {{ sap_ha_install_hana_hsr_hdbuserstore_system_backup_user }} \
       -m <<EOF
-      ALTER SYSTEM ALTER CONFIGURATION ('global.ini', 'SYSTEM') SET ('persistence', 'log_mode') = 'normal' WITH RECONFIGURE;
-      ALTER SYSTEM ALTER CONFIGURATION('global.ini','HOST','{{ ansible_facts['hostname'] }}') SET ('persistence','log_mode') = 'normal' WITH RECONFIGURE;
+      ALTER SYSTEM ALTER CONFIGURATION('global.ini','SYSTEM')
+        SET ('persistence','log_mode')
+        = 'normal' WITH RECONFIGURE;
       EOF
   ignore_errors: true
-  when: __sap_ha_install_hana_hsr_register_log_mode.rc != '0'
+  when: "'normal' not in __sap_ha_install_hana_hsr_register_log_mode.stdout"
   changed_when: true